CVE-2026-84734 — Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter

CVE-2026-84734

Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter PUBLISHED

Description (CNA)

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.

Affected (CNA)

Vendor / product	Versions
Unknown / Mindstien Quick Login	affected 0 through 1.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/648d461c-6610-4566-a310-b02187d68cc9/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.